1//=-- ExprEngineObjC.cpp - ExprEngine support for Objective-C ---*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines ExprEngine's support for Objective-C expressions.
10//
11//===----------------------------------------------------------------------===//
12
13#include "clang/AST/StmtObjC.h"
14#include "clang/StaticAnalyzer/Core/CheckerManager.h"
15#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
16#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
17
18using namespace clang;
19using namespace ento;
20
21void ExprEngine::VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *Ex,
22 ExplodedNode *Pred,
23 ExplodedNodeSet &Dst) {
24 ProgramStateRef state = Pred->getState();
25 const LocationContext *LCtx = Pred->getLocationContext();
26 SVal baseVal = state->getSVal(Ex->getBase(), LCtx);
27 SVal location = state->getLValue(Ex->getDecl(), baseVal);
28
29 ExplodedNodeSet dstIvar;
30 StmtNodeBuilder Bldr(Pred, dstIvar, *currBldrCtx);
31 Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, location));
32
33 // Perform the post-condition check of the ObjCIvarRefExpr and store
34 // the created nodes in 'Dst'.
35 getCheckerManager().runCheckersForPostStmt(Dst, dstIvar, Ex, *this);
36}
37
38void ExprEngine::VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S,
39 ExplodedNode *Pred,
40 ExplodedNodeSet &Dst) {
41 getCheckerManager().runCheckersForPreStmt(Dst, Pred, S, *this);
42}
43
44/// Generate a node in \p Bldr for an iteration statement using ObjC
45/// for-loop iterator.
46static void populateObjCForDestinationSet(
47 ExplodedNodeSet &dstLocation, SValBuilder &svalBuilder,
48 const ObjCForCollectionStmt *S, const Stmt *elem, SVal elementV,
49 SymbolManager &SymMgr, const NodeBuilderContext *currBldrCtx,
50 StmtNodeBuilder &Bldr, bool hasElements) {
51
52 for (ExplodedNode *Pred : dstLocation) {
53 ProgramStateRef state = Pred->getState();
54 const LocationContext *LCtx = Pred->getLocationContext();
55
56 ProgramStateRef nextState =
57 ExprEngine::setWhetherHasMoreIteration(state, S, LCtx, hasElements);
58
59 if (auto MV = elementV.getAs<loc::MemRegionVal>())
60 if (const auto *R = dyn_cast<TypedValueRegion>(MV->getRegion())) {
61 // FIXME: The proper thing to do is to really iterate over the
62 // container. We will do this with dispatch logic to the store.
63 // For now, just 'conjure' up a symbolic value.
64 QualType T = R->getValueType();
65 assert(Loc::isLocType(T));
66
67 SVal V;
68 if (hasElements) {
69 SymbolRef Sym = SymMgr.conjureSymbol(elem, LCtx, T,
70 currBldrCtx->blockCount());
71 V = svalBuilder.makeLoc(Sym);
72 } else {
73 V = svalBuilder.makeIntVal(0, T);
74 }
75
76 nextState = nextState->bindLoc(elementV, V, LCtx);
77 }
78
79 Bldr.generateNode(S, Pred, nextState);
80 }
81}
82
83void ExprEngine::VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S,
84 ExplodedNode *Pred,
85 ExplodedNodeSet &Dst) {
86
87 // ObjCForCollectionStmts are processed in two places. This method
88 // handles the case where an ObjCForCollectionStmt* occurs as one of the
89 // statements within a basic block. This transfer function does two things:
90 //
91 // (1) binds the next container value to 'element'. This creates a new
92 // node in the ExplodedGraph.
93 //
94 // (2) note whether the collection has any more elements (or in other words,
95 // whether the loop has more iterations). This will be tested in
96 // processBranch.
97 //
98 // FIXME: Eventually this logic should actually do dispatches to
99 // 'countByEnumeratingWithState:objects:count:' (NSFastEnumeration).
100 // This will require simulating a temporary NSFastEnumerationState, either
101 // through an SVal or through the use of MemRegions. This value can
102 // be affixed to the ObjCForCollectionStmt* instead of 0/1; when the loop
103 // terminates we reclaim the temporary (it goes out of scope) and we
104 // we can test if the SVal is 0 or if the MemRegion is null (depending
105 // on what approach we take).
106 //
107 // For now: simulate (1) by assigning either a symbol or nil if the
108 // container is empty. Thus this transfer function will by default
109 // result in state splitting.
110
111 const Stmt *elem = S->getElement();
112 const Stmt *collection = S->getCollection();
113 ProgramStateRef state = Pred->getState();
114 SVal collectionV = state->getSVal(collection, Pred->getLocationContext());
115
116 SVal elementV;
117 if (const auto *DS = dyn_cast<DeclStmt>(elem)) {
118 const VarDecl *elemD = cast<VarDecl>(DS->getSingleDecl());
119 assert(elemD->getInit() == nullptr);
120 elementV = state->getLValue(elemD, Pred->getLocationContext());
121 } else {
122 elementV = state->getSVal(elem, Pred->getLocationContext());
123 }
124
125 bool isContainerNull = state->isNull(collectionV).isConstrainedTrue();
126
127 ExplodedNodeSet dstLocation;
128 evalLocation(dstLocation, S, elem, Pred, state, elementV, false);
129
130 ExplodedNodeSet Tmp;
131 StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
132
133 if (!isContainerNull)
134 populateObjCForDestinationSet(dstLocation, svalBuilder, S, elem, elementV,
135 SymMgr, currBldrCtx, Bldr,
136 /*hasElements=*/true);
137
138 populateObjCForDestinationSet(dstLocation, svalBuilder, S, elem, elementV,
139 SymMgr, currBldrCtx, Bldr,
140 /*hasElements=*/false);
141
142 // Finally, run any custom checkers.
143 // FIXME: Eventually all pre- and post-checks should live in VisitStmt.
144 getCheckerManager().runCheckersForPostStmt(Dst, Tmp, S, *this);
145}
146
147void ExprEngine::VisitObjCMessage(const ObjCMessageExpr *ME,
148 ExplodedNode *Pred,
149 ExplodedNodeSet &Dst) {
150 CallEventManager &CEMgr = getStateManager().getCallEventManager();
151 CallEventRef<ObjCMethodCall> Msg =
152 CEMgr.getObjCMethodCall(ME, Pred->getState(), Pred->getLocationContext());
153
154 // There are three cases for the receiver:
155 // (1) it is definitely nil,
156 // (2) it is definitely non-nil, and
157 // (3) we don't know.
158 //
159 // If the receiver is definitely nil, we skip the pre/post callbacks and
160 // instead call the ObjCMessageNil callbacks and return.
161 //
162 // If the receiver is definitely non-nil, we call the pre- callbacks,
163 // evaluate the call, and call the post- callbacks.
164 //
165 // If we don't know, we drop the potential nil flow and instead
166 // continue from the assumed non-nil state as in (2). This approach
167 // intentionally drops coverage in order to prevent false alarms
168 // in the following scenario:
169 //
170 // id result = [o someMethod]
171 // if (result) {
172 // if (!o) {
173 // // <-- This program point should be unreachable because if o is nil
174 // // it must the case that result is nil as well.
175 // }
176 // }
177 //
178 // We could avoid dropping coverage by performing an explicit case split
179 // on each method call -- but this would get very expensive. An alternative
180 // would be to introduce lazy constraints.
181 // FIXME: This ignores many potential bugs (<rdar://problem/11733396>).
182 // Revisit once we have lazier constraints.
183 if (Msg->isInstanceMessage()) {
184 SVal recVal = Msg->getReceiverSVal();
185 if (!recVal.isUndef()) {
186 // Bifurcate the state into nil and non-nil ones.
187 DefinedOrUnknownSVal receiverVal =
188 recVal.castAs<DefinedOrUnknownSVal>();
189 ProgramStateRef State = Pred->getState();
190
191 ProgramStateRef notNilState, nilState;
192 std::tie(notNilState, nilState) = State->assume(receiverVal);
193
194 // Receiver is definitely nil, so run ObjCMessageNil callbacks and return.
195 if (nilState && !notNilState) {
196 ExplodedNodeSet dstNil;
197 StmtNodeBuilder Bldr(Pred, dstNil, *currBldrCtx);
198 bool HasTag = Pred->getLocation().getTag();
199 Pred = Bldr.generateNode(ME, Pred, nilState, nullptr,
200 ProgramPoint::PreStmtKind);
201 assert((Pred || HasTag) && "Should have cached out already!");
202 (void)HasTag;
203 if (!Pred)
204 return;
205
206 ExplodedNodeSet dstPostCheckers;
207 getCheckerManager().runCheckersForObjCMessageNil(dstPostCheckers, Pred,
208 *Msg, *this);
209 for (auto I : dstPostCheckers)
210 finishArgumentConstruction(Dst, I, *Msg);
211 return;
212 }
213
214 ExplodedNodeSet dstNonNil;
215 StmtNodeBuilder Bldr(Pred, dstNonNil, *currBldrCtx);
216 // Generate a transition to the non-nil state, dropping any potential
217 // nil flow.
218 if (notNilState != State) {
219 bool HasTag = Pred->getLocation().getTag();
220 Pred = Bldr.generateNode(ME, Pred, notNilState);
221 assert((Pred || HasTag) && "Should have cached out already!");
222 (void)HasTag;
223 if (!Pred)
224 return;
225 }
226 }
227 }
228
229 // Handle the previsits checks.
230 ExplodedNodeSet dstPrevisit;
231 getCheckerManager().runCheckersForPreObjCMessage(dstPrevisit, Pred,
232 *Msg, *this);
233 ExplodedNodeSet dstGenericPrevisit;
234 getCheckerManager().runCheckersForPreCall(dstGenericPrevisit, dstPrevisit,
235 *Msg, *this);
236
237 // Proceed with evaluate the message expression.
238 ExplodedNodeSet dstEval;
239 StmtNodeBuilder Bldr(dstGenericPrevisit, dstEval, *currBldrCtx);
240
241 for (ExplodedNodeSet::iterator DI = dstGenericPrevisit.begin(),
242 DE = dstGenericPrevisit.end(); DI != DE; ++DI) {
243 ExplodedNode *Pred = *DI;
244 ProgramStateRef State = Pred->getState();
245 CallEventRef<ObjCMethodCall> UpdatedMsg = Msg.cloneWithState(State);
246
247 if (UpdatedMsg->isInstanceMessage()) {
248 SVal recVal = UpdatedMsg->getReceiverSVal();
249 if (!recVal.isUndef()) {
250 if (ObjCNoRet.isImplicitNoReturn(ME)) {
251 // If we raise an exception, for now treat it as a sink.
252 // Eventually we will want to handle exceptions properly.
253 Bldr.generateSink(ME, Pred, State);
254 continue;
255 }
256 }
257 } else {
258 // Check for special class methods that are known to not return
259 // and that we should treat as a sink.
260 if (ObjCNoRet.isImplicitNoReturn(ME)) {
261 // If we raise an exception, for now treat it as a sink.
262 // Eventually we will want to handle exceptions properly.
263 Bldr.generateSink(ME, Pred, Pred->getState());
264 continue;
265 }
266 }
267
268 defaultEvalCall(Bldr, Pred, *UpdatedMsg);
269 }
270
271 // If there were constructors called for object-type arguments, clean them up.
272 ExplodedNodeSet dstArgCleanup;
273 for (auto I : dstEval)
274 finishArgumentConstruction(dstArgCleanup, I, *Msg);
275
276 ExplodedNodeSet dstPostvisit;
277 getCheckerManager().runCheckersForPostCall(dstPostvisit, dstArgCleanup,
278 *Msg, *this);
279
280 // Finally, perform the post-condition check of the ObjCMessageExpr and store
281 // the created nodes in 'Dst'.
282 getCheckerManager().runCheckersForPostObjCMessage(Dst, dstPostvisit,
283 *Msg, *this);
284}
285

source code of clang/lib/StaticAnalyzer/Core/ExprEngineObjC.cpp